CVE-2025-49587

Description

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.

Risk Information

Base Score

8.0

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.202

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default 15.10.16	Windows
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default 16.4.7	Windows
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default 16.10.2	Windows
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default for Linux 15.10.16	Linux
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default for Linux 16.4.7	Linux
Vulnerabilities CVE-2025-49587,CVE-2025-49583 are fixed in XWiki - xwiki-platform-notifications-notifiers-default for Linux 16.10.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234